ecache.pdb
Static task
static1
1 signatures
General
-
Target
0d314ae7bcea31d87756e250c28347ed_JaffaCakes118
-
Size
129KB
-
MD5
0d314ae7bcea31d87756e250c28347ed
-
SHA1
4cefbfbd9942080d4eb0e303f7b35a74899bc10f
-
SHA256
ccaa8d9c211b8f01df222b06bcadefa0ffeb78f7e7e53cacba6c15f0feaeb43a
-
SHA512
9a2b0f58802beff6bb407d27c032316cb50081ab5644aa43670a3f94a09b26d44c8e63e5d9637822df18f614b6a7a4ab71c1dd0583bce09f116d385835f50f8f
-
SSDEEP
3072:3TQOY8aCzySdzWLbqwpQKfkj14srnwmBofMqqDLy/aSWCbU:3GWra+wKmI14f0qqDLuaSU
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d314ae7bcea31d87756e250c28347ed_JaffaCakes118
Files
-
0d314ae7bcea31d87756e250c28347ed_JaffaCakes118.sys windows:6 windows x86 arch:x86
ce078af7cfa6687436bc96f4db303ba1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExfReleasePushLock
KeQuerySystemTime
_alldiv
ZwQuerySystemInformation
KeSetEvent
PoStartNextPowerIrp
IoCallDriverStackSafe
IofCompleteRequest
KeInitializeEvent
ExFreePoolWithTag
ObSetSecurityObjectByPointer
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
SeExports
IoAllocateWorkItem
RtlInitUnicodeString
KeWaitForSingleObject
KeSetTimer
KeResetEvent
ZwClose
IoUnregisterPlugPlayNotification
ObfDereferenceObject
ZwQueryVolumeInformationFile
IoBuildSynchronousFsdRequest
ZwFsControlFile
ZwSetInformationFile
IoFileObjectType
IoCreateFile
ZwReadFile
IoGetRelatedDeviceObject
ZwCreateFile
ObQueryNameString
RtlCopyUnicodeString
IoGetDeviceAttachmentBaseRef
MmFreePagesFromMdl
MmUnmapLockedPages
IoFreeMdl
MmMapLockedPagesSpecifyCache
memcpy
IoReleaseCancelSpinLock
_aullshr
IoFreeWorkItem
NtTraceEvent
IoWMIWriteEvent
RtlCompareMemory
ExfAcquirePushLockExclusive
InterlockedPopEntrySList
IoBuildDeviceIoControlRequest
ExReleaseRundownProtection
ExAcquireRundownProtection
ZwSetValueKey
ZwOpenKey
ZwSetSystemInformation
ZwQueryValueKey
_allshl
ExRegisterCallback
ExCreateCallback
ExUnregisterCallback
IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStack
ExInitializeRundownProtection
IoCreateDevice
IoFreeIrp
MmAllocatePagesForMdl
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoQueueWorkItem
ZwWriteFile
ZwPowerInformation
IoQueueWorkItemEx
ExWaitForRundownProtectionRelease
KeInitializeDpc
KeInitializeTimer
IoGetIoPriorityHint
IoRegisterPlugPlayNotification
ExEventObjectType
IoSetIoPriorityHint
IoAllocateIrp
KeGetCurrentThread
PoCallDriver
KeClearEvent
IoReuseIrp
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PsGetCurrentThread
KeSetActualBasePriorityThread
KeSetPriorityThread
qsort
MmSizeOfMdl
PsCreateSystemThread
MmUnlockPages
IoBuildAsynchronousFsdRequest
IoWMIRegistrationControl
IofCallDriver
InitSafeBootMode
RtlQueryRegistryValues
KeTickCount
KeBugCheckEx
memset
_allshr
_allmul
_aulldiv
_vsnprintf
ObReferenceObjectByHandle
InterlockedPushEntrySList
IoGetStackLimits
MmGetSystemRoutineAddress
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
IoIsWdmVersionAvailable
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
ZwCreateKey
RtlFreeUnicodeString
PsGetCurrentThreadId
PsGetCurrentProcessId
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExDeleteResourceLite
ExInitializeResourceLite
RtlUnwind
hal
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeQueryPerformanceCounter
KeStallExecutionProcessor
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGELK Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGER32C Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGER32R Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ